Files
nuclei-templates/javascript/udp/detection/zeroconf-detect.yaml
2025-10-26 16:17:37 +00:00

41 lines
1.3 KiB
YAML

id: zeroconf-detect
info:
name: Zeroconf - Detect
author: pussycat0x
severity: info
description: |
Queried `_services._dns-sd._udp.local` over UDP/5353 and identified Zeroconf (mDNS/DNS-SD) services that were advertised locally.
reference:
- https://en.wikipedia.org/wiki/Zero-configuration_networking
metadata:
verified: true
zoomeye-query: service="zeroconf"
tags: zeroconf,network,js,udp,discovery
javascript:
- pre-condition: |
isUDPPortOpen(Host,Port);
code: |
let packet = bytes.NewBuffer();
const c = require("nuclei/net");
const cmd = "000000000001000000000000095f7365727669636573075f646e732d7364045f756470056c6f63616c00000c0001"
packet.WriteString(cmd)
let conn = c.Open('udp', `${Host}:${Port}`);
conn.SendHex(packet);
const result = conn.RecvFullHex();
result
args:
Host: "{{Host}}"
Port: 5353
matchers:
- type: dsl
dsl:
- 'success == true'
- 'contains_all(response, "udp.local","rvices._dns-sd") || contains(response, "-servers.net")'
condition: and
# digest: 4a0a004730450220524ac9b56a8c8a563a9896a7095526b463784d795c1976724301cd464a249ff3022100a202d0477cdfc336b3501bc911e3e3c04d4174d844d17ba7c65e6466ae44c993:922c64590222798bb761d5b6d8e72950